https://bugzilla.novell.com/show_bug.cgi?id=410032 User mfabian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c1 --- Comment #1 from Mike Fabian 2008-07-17 10:25:29 MDT --- First of all, racoond failed to start: mike@nozomi:~$ sudo rcracoond restart Shutting down IPsec IKE daemon (racoon) done Setting up IPsec policies done Starting IPsec IKE daemon (racoon) done mike@nozomi:~$ racoon: failed to parse configuration file. mike@nozomi:~$ ps aux | grep racoon mike 4837 0.0 0.1 9248 900 pts/2 R+ 18:19 0:00 grep racoon mike@nozomi:~$ Trying to find out why not, I found: mike@nozomi:~$ sudo /usr/sbin/racoon -F -v -d -d -f /etc/racoon/racoon.conf [...] 2008-07-17 18:21:54: DEBUG2: pre-shared key(1) 2008-07-17 18:21:54: DEBUG2: 2008-07-17 18:21:54: DEBUG: hmac(modp768) 2008-07-17 18:21:54: ERROR: Not supported. 2008-07-17 18:21:54: ERROR: /etc/racoon/racoon.conf:143: ";" algorithm DES not supported by the kernel (missing module?) 2008-07-17 18:21:54: ERROR: fatal parse failure (1 errors) racoon: failed to parse configuration file. mike@nozomi:~$ I found that the 32bit machine had the following module loaded mike@linux:~$ lsmod | grep des des_generic 20992 0 mike@linux:~$ but the 64bit machine didn’t have this module loaded. I have no idea why. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User mfabian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c3 --- Comment #3 from Mike Fabian 2008-07-17 10:36:25 MDT --- But even with the module loaded, vpn still doesn’t work. When I do the following as root: nozomi:~ # pwd /root nozomi:~ # nvpn -c NUE User Name : [mfabian] User Password : Failed to connect to AdminSock(/var/run/racoon/racoon.sock)! 111 VPNCLIENT-UI-4611:Failed to connect to the Gateway. Failed to connect to IKE. Restart IKE.nozomi:~ # nozomi:~ # I see the above error message and racoon has stopped running: nozomi:~ # ps aux | grep racoon root 7448 0.0 0.1 9248 900 pts/2 R+ 18:34 0:00 grep racoon nozomi:~ # This is always reproducible. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 Li Bin changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|bnc-team-screening@forge.provo.novell.com |bili@novell.com Status|NEEDINFO |ASSIGNED Info Provider|mfabian@novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User mfabian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c5 Mike Fabian changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED Info Provider|mfabian@novell.com | --- Comment #5 from Mike Fabian 2008-07-18 03:45:18 MDT --- Actually I don’t really know. The ifconfig output on the 64bit machine, where it does not work, is: mike@nozomi:/etc/sysconfig$ ifconfig dsl0 Link encap:Point-to-Point Protocol inet addr:83.171.162.87 P-t-P:82.135.16.28 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1 RX packets:880460 errors:0 dropped:0 overruns:0 frame:0 TX packets:1650826 errors:0 dropped:1 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:77813360 (74.2 Mb) TX bytes:1959295120 (1868.5 Mb) eth1 Link encap:Ethernet HWaddr 00:04:61:5C:D5:D9 inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::204:61ff:fe5c:d5d9/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:905367 errors:0 dropped:0 overruns:0 frame:0 TX packets:1674832 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:106180719 (101.2 Mb) TX bytes:2008417548 (1915.3 Mb) Interrupt:16 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:6202765 errors:0 dropped:0 overruns:0 frame:0 TX packets:6202765 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:52799819371 (50353.8 Mb) TX bytes:52799819371 (50353.8 Mb) mike@nozomi:/etc/sysconfig$ This 64bit machine is my router/gateway. On the 32bit machine, where it does work, the ifconfig output is: mike@linux:/etc/sysconfig$ ifconfig eth0 Link encap:Ethernet HWaddr 00:11:09:AC:05:29 UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:22 Base address:0x8c00 eth1 Link encap:Ethernet HWaddr 00:0E:35:C8:53:89 eth0 Link encap:Ethernet HWaddr 00:11:09:AC:05:29 UP BROADCAST MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Interrupt:22 Base address:0x8c00 inet addr:192.168.1.5 Bcast:192.168.1.255 Mask:255.255.255.0 inet6 addr: fe80::20e:35ff:fec8:5389/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:118976 errors:0 dropped:0 overruns:0 frame:0 TX packets:64438 errors:0 dropped:2 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:2238424035 (2134.7 Mb) TX bytes:413000223 (393.8 Mb) Interrupt:17 Base address:0x6000 Memory:fbffe000-fbffefff eth1:1 Link encap:Ethernet HWaddr 00:0E:35:C8:53:89 inet addr:149.44.164.13 Bcast:149.44.164.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:17 Base address:0x6000 Memory:fbffe000-fbffefff lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:274059 errors:0 dropped:0 overruns:0 frame:0 TX packets:274059 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:233060751 (222.2 Mb) TX bytes:233060751 (222.2 Mb) mike@linux:/etc/sysconfig$ Does it matter that no inet6 addr is listed for the dsl0 interface on my gateway (the 64bit machine)? I found that there is a variablee IPV6_FORWARD in /etc/sysconfig/sysctl: mike@nozomi:/etc/sysconfig$ grep -i ipv6 sysctl # Runtime-configurable parameter: forward IPv6 packets. IPV6_FORWARD="yes" # Runtime-configurable parameter: use temporary IPv6 addresses IPV6_PRIVACY=no IPV6_MLD_VERSION="" mike@nozomi:/etc/sysconfig$ This variable was set to "no" on both machines, I have just now set it to "yes" on the 64bit machine. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User mfabian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c7 Mike Fabian changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |ASSIGNED Info Provider|mfabian@novell.com | --- Comment #7 from Mike Fabian 2008-07-18 05:22:51 MDT --- In that case, ipv6 was already enabled. Both on the 64bit machine and the 32bit machine this dialog in YaST looked like this, i.e. I didn’t need to enable ipv6: YaST2 - lan @ nozomi Network Settings [=> Global Options][Overview][Hostname/DNS][Routing] ┌───────────────────────────────────────────────────────────────────────────────┐ │ ┌Network Setup Method───────────────────────────────────────────────────────┐ │ │ │( ) User Controlled with NetworkManager │ │ │ │(x) Traditional Method with ifup │ │ │ └───────────────────────────────────────────────────────────────────────────┘ │ │ ┌IPv6 Protocol Settings─────────────────────────────────────────────────────┐ │ │ │[x] Enable IPv6 │ │ │ └───────────────────────────────────────────────────────────────────────────┘ │ │ ┌DHCP Client Options────────────────────────────────────────────────────────┐ │ │ │[ ] Request Broadcast Response │ │ │ │DHCP Client Identifier │ │ │ │▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒│ │ │ │Hostname to Send │ │ │ │AUTO▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒│ │ │ │[x] Change Default Route via DHCP │ │ │ └───────────────────────────────────────────────────────────────────────────┘ │ │ │ -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User mfabian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c9 --- Comment #9 from Mike Fabian 2008-07-18 10:07:41 MDT --- After a lot of searching I could make a lot of progress. I found that many modules which should have been loaded were not. I already wrote in comment #1 that “des_generic” had not been loaded automatically. But that was not the only one. I also had some problems with the firewall because of modules which were not loaded. I found that the reason for this trouble with the modules was this file: mike@nozomi:~$ cat /etc/modprobe.d/unsupported.blacklist # # Every kernel module has a flag 'supported'. If this flag is not set loading # this module will taint your kernel. You will not get much help with a kernel # problem if your kernel is marked as tainted. In this case you firstly have # to avoid loading of unsupported modules. # # Enabling this entry makes sure that autoloading of modules via module aliases # will skip unsupported modules. Commenting this out enables autoloading of # these modules. ## include modules.unsupported.blacklist mike@nozomi:~$ The last line, with the “include” was *not* commented out. The reason was probably that I updated the machine from older SuSE releases for years and never reinstalled. On older SuSE releases a file /etc/sysconfig/hardware/config existed which had a variable specifying whether unsupported modules should be loaded automatically or not. Now the postinstall scriptlet of thhe package module-init-tools looks like this: mike@nozomi:~$ rpm -q --scripts module-init-tools-3.4-15.1 postinstall scriptlet (using /bin/sh): # when updating from and older version, make sure # modules.unsupported.blacklist is here to avoid warnings from modprobe uname_r=`uname -r` if test -e "/lib/modules/$uname_r/modules.dep" -a \ ! -e "/lib/modules/$uname_r/modules.unsupported.blacklist"; then depmod fi # default is to blacklist unblacklist="" # if the obsolete LOAD_UNSUPPORTED_MODULES_AUTOMATICALLY variable is set to # yes, unblacklist if test -e /etc/sysconfig/hardware/config; then . /etc/sysconfig/hardware/config if test "x$LOAD_UNSUPPORTED_MODULES_AUTOMATICALLY" = "xyes"; then unblacklist=yes fi # obsolete rm /etc/sysconfig/hardware/config fi # if this is _new install_ and we are not SLES, unblacklist if test "$1" = 1; then if ! grep -qs "Enterprise Server" /etc/SuSE-release; then unblacklist=yes fi fi if test "x$unblacklist" = "xyes"; then sed -i 's/^include modules\.unsupported\.blacklist/## &/' \ /etc/modprobe.d/unsupported.blacklist fi mike@nozomi:~$ i.e. this reads the old file from sysconfig. If the variable was set to LOAD_UNSUPPORTED_MODULES_AUTOMATICALLY=no (which was probably the case on one of the ancient systems where I did the original install), the comments in front of the line to include the blacklist in /etc/modprobe.d/unsupported.blacklist are removed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User bili@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c11 Li Bin changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO Info Provider| |mfabian@novell.com --- Comment #11 from Li Bin 2008-07-21 03:50:36 MDT --- Mike, Ok, now would mind send back your /var/log/messages when you do in Comment #10, also if you could capture the packet would be better. tcpdump -i any -s 1024 -w troubeshooting.cap -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User mfabian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c13 --- Comment #13 from Mike Fabian 2008-07-21 05:30:06 MDT --- Created an attachment (id=229042) --> (https://bugzilla.novell.com/attachment.cgi?id=229042) troubeshooting.cap File written by sudo tcpdump -i any -s 1024 -w troubeshooting.cap during the time from a nvpn -c NUE until I try to ping my machine in the office. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User agruen@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c15 --- Comment #15 from Andreas Gruenbacher 2008-07-28 05:17:54 MDT --- This seems to be related to FATE #305100: better handling of unsupported modules in module-init-tools. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User mfabian@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c17 --- Comment #17 from Mike Fabian 2008-07-28 07:56:49 MDT --- I have updated from 10.2 to 11.0. But the 10.2 installation was not a new installation either, the machine has been only updated and never reinstalled for several years, maybe since SuSE Linux 9.0. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 Li Bin changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO Info Provider| |mfabian@novell.com -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=410032 User bili@novell.com added comment https://bugzilla.novell.com/show_bug.cgi?id=410032#c20 Li Bin changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED Info Provider|mfabian@novell.com | Resolution| |NORESPONSE --- Comment #20 from Li Bin 2008-09-15 20:39:43 MDT --- ->Noresponse. More than 2 weeks. Feel free to reopen it when it still have issue. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.